Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN758 _____________________________________________________________________ DATE : 16/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running mantisbt versions prior to 2.28.4. ===================================================================== https://github.com/mantisbt/mantisbt/security/advisories/GHSA-c2xg-qjqw-2v98 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-77x8-3v3h-hrhv https://github.com/mantisbt/mantisbt/security/advisories/GHSA-vcrw-4xvv-jh49 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h2wf-967x-gxvw https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v84x-qvhg-f36r https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mw6p-33vw-46cc https://github.com/mantisbt/mantisbt/security/advisories/GHSA-m7ph-9558-mrx3 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-3v2j-6fw9-f57c _____________________________________________________________________ SOAP API Authentication Bypass with Privilege Escalation to Administrator Critical dregad published GHSA-c2xg-qjqw-2v98 Package mantisbt/mantisbt (Composer) Affected versions <= 2.28.3 Patched versions 2.28.4 Description MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API. The REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed. The Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client. Impact Full administrator access to the SOAP API from zero prior access (with self-registration enabled, which is the default) Read/write all issues including private issues and notes across all projects Full data exfiltration of all bug reports, attachments, user accounts (id, name, email), and non-private configuration values via the 71 SOAP operations available Destructive operations: delete projects, issues, attachments, tags, categories, and versions Data manipulation: create/modify issues, impersonate reporters, manage project structure Chains with other vulnerabilities: the SOAP admin access enables exploitation of SOAP vulnerabilities that require administrator privileges Patches e3571c3 Workarounds None References https://mantisbt.org/bugs/view.php?id=37121 Credits We would like to thank McCaulay Hudson (@_McCaulay) of watchTowr for originally identifying and responsibly reporting the issue. The vulnerability was subsequently discovered by other researchers, while we were working on fixing it and preparing the release. We credit them here, in chronological order of their reports: Keitaro Yamazaki (@tyage) Harrison Keating (@voraci0us) Chandler Johnson (@chndlrx) Bharat Devasani (@bharatdevasani) Severity Critical 9.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-47156 Weaknesses Weakness CWE-287 Weakness CWE-639 Credits @McCaulay McCaulay Finder @dregad dregad Remediation developer @tyage tyage Finder @voraci0us voraci0us Finder @chndlrx chndlrx Finder @bharatdevasani bharatdevasani Finder _____________________________________________________________________ Reflected XSS in admin/install.php via print_test_result() Critical dregad published GHSA-77x8-3v3h-hrhv Package mantisbt/mantisbt (Composer) Affected versions <= 2.28.3 Patched versions 2.28.4 Description MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required. A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and open redirects. Impact Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server. Open redirect: Victim is silently redirected to a phishing or malware site. UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering. Patches 0f32cea f2191a0 Workarounds Remove the /admin directory, as recommended in the Admin Guide References https://mantisbt.org/bugs/view.php?id=37103 related advisory GHSA-vcrw-4xvv-jh49 Credits McCaulay Hudson (@_McCaulay) of watchTowr Severity Critical 9.2/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability Low Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVE ID CVE-2026-52847 Weaknesses Weakness CWE-79 Credits @McCaulay McCaulay Finder @dregad dregad Remediation developer _____________________________________________________________________ Reflected XSS in admin/install.php via unescaped printf Critical dregad published GHSA-vcrw-4xvv-jh49 Package mantisbt/mantisbt (Composer) Affected versions <= 2.28.3 Patched versions 2.28.4 Description MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via an unescaped printf format string. No authentication is required. A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and open redirects. Impact Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server. Open redirect: Victim is silently redirected to a phishing or malware site. UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering. Patches 297773f Workarounds Remove the /admin directory, as recommended in the Admin Guide References https://mantisbt.org/bugs/view.php?id=37103 related advisory GHSA-77x8-3v3h-hrhv Credits McCaulay Hudson (@_McCaulay) of watchTowr Severity Critical 9.2/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability Low Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVE ID CVE-2026-52881 Weaknesses Weakness CWE-79 Credits @McCaulay McCaulay Finder @dregad dregad Remediation developer _____________________________________________________________________ Stored XSS in print_all_bug_page_word.php High dregad published GHSA-h2wf-967x-gxvw Package mantisbt/mantisbt (Composer) Affected versions <= 2.28.3 Patched versions 2.28.4 Description A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert(1). When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes , breaking out of the alt attribute. Impact Cross-site scripting. Impact is limited by MantisBT's Content Security Policy. Patches bdd0e36 Workarounds None References https://mantisbt.org/bugs/view.php?id=37234 Credits Thanks to the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue. Severity High 8.6/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required Low User interaction Passive Vulnerable System Impact Metrics Confidentiality High Integrity High Availability Low Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVE ID CVE-2026-62944 Weaknesses Weakness CWE-79 Credits @dracosectech-code dracosectech-code Finder @dregad dregad Remediation developer _____________________________________________________________________ Remote Code Execution via eval() Class Hoisting in adm_config_set.php High dregad published GHSA-v84x-qvhg-f36r Package mantisbt/mantisbt (Composer) Affected versions >= 1.3.0, <= 2.28.3 Patched versions 2.28.4 Description MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature (adm_config_set.php). When setting a configuration value with a non-string type (integer, float, complex), the value is passed through ConfigParser -> Tokenizer, which calls eval() with a return; prefix intended to prevent code execution. However, PHP hoists function and class declarations at compile time, even past a return statement. An attacker can define a class in the eval()'d code that hijacks a class loaded later via PHP's autoloader, achieving arbitrary code execution. This vulnerability requires administrator access to the web UI (adm_config_set.php). The REST API's ConfigsSetCommand does NOT use Tokenizer/eval() and is not affected. Impact Remote code execution as the web server user (www-data) from an authenticated administrator session Patches 78c0af6 Workarounds None. References https://mantisbt.org/bugs/view.php?id=37122 Credits McCaulay Hudson (@_McCaulay) of watchTowr Severity High 8.6/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required High User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-49273 Weaknesses Weakness CWE-95 Credits @McCaulay McCaulay Finder @dregad dregad Remediation developer _____________________________________________________________________ SQL Injection via history_order Configuration Value High dregad published GHSA-mw6p-33vw-46cc Package mantisbt/mantisbt (Composer) Affected versions <= 2.28.3 Patched versions 2.28.4 Description MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist. An administrator can set this configuration value via the web UI (adm_config_set.php) or the REST API (PATCH /api/rest/config). The injected SQL then executes whenever any user views a bug with history entries. Impact Sensitive data extraction from the entire bugtracker database including user credentials (cookie_string, password hashes), API tokens, and private issue data With MySQL FILE privilege: full RCE via INTO OUTFILE writing a PHP webshell to the web root The admin plants the payload once; any authenticated user viewing a bug with history triggers the injection Patches 6ad20be Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? References https://mantisbt.org/bugs/view.php?id=37123 Credits McCaulay Hudson (@McCaulay) of watchTowr Severity High 8.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required High User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVE ID CVE-2026-47142 Weaknesses Weakness CWE-89 Credits @McCaulay McCaulay Finder @dregad dregad Remediation developer _____________________________________________________________________ REST & SOAP API unauthorized Issue status change Moderate dregad published GHSA-m7ph-9558-mrx3 Jul 15, 2026 Package mantisbt/mantisbt ( Composer ) Affected versions >= 2.8.0, <= 2.28.3 Patched versions 2.28.4 Description A MantisBT user having $g_update_bug_threshold (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the $g_set_status_threshold config is set to a higher level (DEVELOPER by default). Impact Unauthorized change in Issue workflow. Patches Work in progress Workarounds None References https://mantisbt.org/bugs/view.php?id=37181 Credits Mamdouh Mahfouz (@mamdouhmahfouz) Severity Moderate 5.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity Low Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVE ID CVE-2026-49280 Weaknesses Weakness CWE-862 Credits @dregad dregad Remediation developer @mamdouhmahfouz mamdouhmahfouz Finder _____________________________________________________________________ Issue update via REST and SOAP API accepts unreleased Product Version from Updaters Moderate dregad published GHSA-3v2j-6fw9-f57c Package mantisbt/mantisbt (Composer) Affected versions <= 2.28.3 Patched versions 2.28.4 Description Impact Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions. Patches 17072d4 Workarounds None References https://mantisbt.org/bugs/view.php?id=37065 Credits Thanks to Vishal Shukla for discovering and responsibly reporting the issue. Severity Moderate 5.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity Low Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVE ID CVE-2026-52882 Weaknesses Weakness CWE-639 Credits @dregad dregad Remediation developer ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================